fix: validate client state JavaScript identifiers

[harsh21234i]

ClientStateVar names are used as JavaScript bindings, so invalid identifiers or names that conflict with reserved words and generated Reflex bindings can produce broken frontend code.

Validate names when creating a ClientStateVar, and add tests covering rejected names and valid identifiers.

Fixes #6828.

Tests: 27 targeted tests passed; isolated Ruff check passed.

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with a remaining non-blocking limit on accepted Unicode names.

Findings

1.  Valid Unicode names are rejected ▶

Summary

Adds checks for ClientStateVar names before generating JavaScript.

• Client state names now need valid JavaScript bindings.

_{Reviews (2) · Last reviewed commit: "fix: cover client state identifier edge ..." · Reviewed by Greptile}

[greptile-apps]

Valid Unicode names are rejected

Python's isidentifier() rejects some valid JavaScript names. For example, "value\u200cname" contains a zero-width non-joiner, which JavaScript permits after the first character but Python rejects. This now raises ValueError for a name that previously produced valid JavaScript. Use JavaScript's identifier rules and cover these Unicode differences in the tests.

[codspeed]

Merging this PR will not alter performance

⚠️ 16 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

• test_cli_startup[run_help]
• test_cli_startup[cloud_help]
• test_import_cli
• test_modify_state[disk]
• test_get_state[disk]
• test_yield_intermediate_update
• test_emit_update
• test_set_state[disk]
• test_state_manager_memory_warm_get
• test_event_future_tree
• …and 6 more

✅ 148 untouched benchmarks

---

_{Comparing harsh21234i:fix/6828-client-state-js-identifiers (f591cc4) with main (5ae5dcd)}